Skip to main content
72 votes
Accepted

Filter arbitrary code for blacklisted keywords except on commented lines

This is not a secure approach for several reasons. First, using a simplistic search-and-replace approach instead of a Python parser means there's a huge risk that an attacker can take advantage of ...
Ja1024's user avatar
  • 11.4k
14 votes
Accepted

Execute a PHP function that returns an array from an XSL file

I am also a noob when it comes to XSL. To be honest, I had no idea it could be this powerful... and dangerous. But I will have a shot at this anyway. I don't know if it is possible to get the output ...
Anders's user avatar
  • 65.7k
13 votes
Accepted

Special characters in filename leads to starting virus executable

The trick is the right-to-left override character. Languages such as Arabic write right-to-left instead of left-to-right. To embed such text in a string, you can switch the direction of the text, and ...
Sjoerd's user avatar
  • 31.8k
13 votes

Filter arbitrary code for blacklisted keywords except on commented lines

Try Lua If you just need to run user-supplied scripts and aren't too concerned about what language the scripts are written in, you might find Lua a better fit than Python. Lua is designed to allow you,...
Keiji's user avatar
  • 231
10 votes
Accepted

Can a CSV contain malicious code?

Yes, there are some examples of malicious CSV files causing random "code" execution. People choose to open CSV files in MS Excel or Open Office or such software which have macro execution capabilities....
whoami's user avatar
  • 1,366
8 votes

How to put executable code in files?

The field that you're nibbling at is called Digital Rights Management (DRM), and it's a big field. Protecting your documents and music, for example, fall under Content Restrictions. There are ...
gowenfawr's user avatar
  • 73k
7 votes
Accepted

Difference between Code Injection, Command Injection and Remote Code Execution

Hmm let me try: Code injection consists of modifying an executable / compilation unit / script so that it contains malicious code on top of it´s intended functions. Code can be injected locally into ...
flohack's user avatar
  • 547
7 votes
Accepted

Can I inject a shell command here in PHP?

At least, the newline is not escaped, so, you can bypass it via /index.php?arg=%0Als (it should list all files from the current directory). Also, there is a possibility to get a Full Path Disclosure ...
Victor's user avatar
  • 216
6 votes

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.)

Path is defined in bash profile so that ~/bin comes last, so running "firefox" should run the default firefox and not a custom "firefox" installed by the user in their home directory. Variables can ...
vidarlo's user avatar
  • 16.6k
6 votes

Filter arbitrary code for blacklisted keywords except on commented lines

Defending against arbitrary code execution while allowing code execution is not an easy problem. Most web browsers use a defence-in-depth approach to this, and you should too. For example: Use either ...
jpa's user avatar
  • 1,299
5 votes
Accepted

Understanding preg_replace Filtering & Exploitation

There are two issues here, both of which you can solve. How preg_replace e works, and how to exploit it The first problem is that preg_replace with e doesn't just execute anything you pass to it. It ...
tim's user avatar
  • 29.7k
5 votes
Accepted

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

No, this is not vulnerable to PHP code injection. The string passed to eval() is simply not user-controlled. There is no path from the source $_GET["cmd1"] to the sink eval(): The argument to eval() ...
Arminius's user avatar
  • 45k
5 votes
Accepted

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?

I don't know the exact statement and its context so I can only guess what was meant: if a script gets sourced instead of executed in a separate shell then any variables or functions defined in this ...
Steffen Ullrich's user avatar
4 votes
Accepted

Removing execute permissions on `/tmp` or mounting it with `noexec` flag?

You are actually discussing three separate hardening techniques. Separate Partitions Separate partitions does two things for you. It first isolates systems. This can be beneficial in many ways not ...
Shane Andrie's user avatar
  • 3,840
4 votes

Can a CSV contain malicious code?

Yes, it may contain arbitrary system commands that will be executed on the machine where you are opening the CSV file. Your spreadsheet software will render the CSV values as the injected commands and ...
Arka's user avatar
  • 571
4 votes

How can I disable execution of programs from Downloads directory in Windows 10?

Changing permissions on the directory is probably the best way to go, yes. In addition to being relatively easy, it has the perk of acting more like the way most Unix-like systems work, where new (in ...
CBHacking's user avatar
  • 49.6k
4 votes

Executable files in email attachments on UNIX

UNIX alike systems like Linux or MacOS do not run any executable files just because they have a specific extension. To make a file directly executable it needs to have the executable-bit set (chmod +x ...
Steffen Ullrich's user avatar
4 votes
Accepted

Running a brief asm script inline for dynamic analysis

Is there a reason you can't just study the code? 30 lines of ASM should be easy to understand. Just add comments explaining what each line does, and you'll understand it in no time. This will be even ...
forest's user avatar
  • 67k
4 votes

Security Implications from Base64 Image

There's nothing magic about base64. It's just a way of storing arbitrary binary data in a character set that is safe for printing and transmission as pure text (ASCII). It's no more dangerous because ...
vidarlo's user avatar
  • 16.6k
3 votes
Accepted

Adding network drive to trusted intranet sites security hole?

This error dialog is there to make users aware of the potentially dangerous source from where the file comes. When you say [B]ut currently, a user would just click run or open in the dialog box ...
Tobi Nary's user avatar
  • 14.4k
3 votes

Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?

In short, the answer is yes to the use of UTF-8 characters in an attack chain. There are a few cases that have crossed my path. What I have read about this method of attack, is that this it is the ...
Chukk Chukk's user avatar
3 votes
Accepted

How to execute PHP file after uploading it?

Is there any way to execute the PHP shell on this server? Probably not. For that to happend, the server has to have a PHP engine installed and be configured to respond to request for PHP files by ...
Anders's user avatar
  • 65.7k
3 votes
Accepted

How to find which program encrypted my files?

.lin Extension Virus is quite a bad worm, file-encrypting virus. It is known to delete users encrypted data after if receiving the ransom money, so the ransom is a no-go anyway. SpyHunter is a known ...
Overmind's user avatar
  • 8,899
3 votes

Is there any way to estimate the safety of arbitrary binaries, which are usually released with unofficial patches?

I suppose that it is hardly possible to include malware by arbitrarily changing a few bytes in the executable; so this should be safe; Viruses can easily be as small as about 50 bytes of code, so ...
phyrfox's user avatar
  • 5,734
3 votes

What are some examples of known scenarios of network attacks?

A bunch of network packets does not usually reside in code execution. It can though result in code execution if the software dealing with these packets (i.e. the OS kernel, a specific driver or some ...
Steffen Ullrich's user avatar
3 votes
Accepted

What are some examples of known scenarios of network attacks?

If it's really a bunch of network packets, the target computer has to be somehow vulnerable: there has to be something that interprets these packets in a way it's not supposed. The requirements for ...
Esa Jokinen's user avatar
  • 19.1k
3 votes

Is it possible to detect malicious software just by analyzing the code structure?

No you can't, not all the time reliably. To detect viruses simply by static analysis would likely contradict Rice's Theorem which says that such problem is undecidable.
Lie Ryan's user avatar
  • 31.5k
3 votes
Accepted

Safe usage of Runtime.getRuntime.exec(String[])

I ran your program, linked to a checkfileindirectory.sh that looks like this: #!/bin/bash echo $1 > param1.txt echo $2 > param2.txt As a test, I changed "<file_to_find>" to "<...
Mike Ounsworth's user avatar
3 votes
Accepted

Can't execute shell i uploaded with cURL

You get the file contents in curl because you are accessing the file directly without the server executing the contents. You are not getting the shell in the browser because the PHP server is trying ...
schroeder's user avatar
  • 131k
2 votes

Trusted (sealed) execution environment in Linux

No, this is not possible. Not in Linux and not in any other computer environment. It isn't a limitation of Linux, it's a limitation of physics. If you run your code on someone else's computer… it's ...
Gilles 'SO- stop being evil''s user avatar

Only top scored, non community-wiki answers of a minimum length are eligible